Remote Access Tool - ScreenConnect Installation Execution
Detects ScreenConnect program starts that establish a remote access to a system.
Sigma rule (View on GitHub)
1title: Remote Access Tool - ScreenConnect Installation Execution
2id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962
3status: test
4description: Detects ScreenConnect program starts that establish a remote access to a system.
5references:
6 - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
7author: Florian Roth (Nextron Systems)
8date: 2021/02/11
9modified: 2024/02/26
10tags:
11 - attack.initial_access
12 - attack.t1133
13logsource:
14 category: process_creation
15 product: windows
16detection:
17 selection:
18 CommandLine|contains|all:
19 - 'e=Access&'
20 - 'y=Guest&'
21 - '&p='
22 - '&c='
23 - '&k='
24 condition: selection
25falsepositives:
26 - Legitimate use by administrative staff
27level: medium
References
Related rules
- External Remote Service Logon from Public IP
- Remote Access Tool - ScreenConnect Server Web Shell Execution
- User Added to Remote Desktop Users Group
- Exchange Webshell creation
- CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security